CVE-2026-115608
HIGH 8.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.
Severe if exploited (CVSS 8.5), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
—EPSS not yet scored
Impact if exploited
8.5CVSS 3.1 · HIGH
- ConfidentialityHigh
- IntegrityNone
- AvailabilityLow
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
References and research data (JSON)
References
Advisories
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109727 EUVD · EUVD-2026-109727
Technical & other
- https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-9-0-sql-injection-vulnerability?_s_id=cve CVE record · Patchstack · Updated 2026-10-26T10:29:00.541Z